Re: [tor-relays] exit node experience: abuse over HTTP, stealrat infection

2014-10-29 Thread elrippo
On Freitag, 24. Oktober 2014, 09:16:49 Tom van der Woerdt wrote: Manuel Gebauer schreef op 19/10/14 15:29: Hi, Tom and Rejo. Same with me. Half of the abuse complaints I get are from Valuehost Ru. Because I run on a cheap VPS I don't get a reassigned IP. Therefore I always fear that my

Re: [tor-relays] exit node experience: abuse over HTTP, stealrat infection

2014-10-24 Thread Tom van der Woerdt
Manuel Gebauer schreef op 19/10/14 15:29: Hi, Tom and Rejo. Same with me. Half of the abuse complaints I get are from Valuehost Ru. Because I run on a cheap VPS I don't get a reassigned IP. Therefore I always fear that my provider might lose patience and shut down my server. That's why I decided

Re: [tor-relays] exit node experience: abuse over HTTP, stealrat infection

2014-10-24 Thread Thomas White
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Ask your upstream to filter their reports if you can, I can testify I have received in excess of 300 complaints from them and ironically, they ignored all of my responses to them for the first 200 or so I responded to. Ultimately (if you'll excuse my

Re: [tor-relays] exit node experience: abuse over HTTP, stealrat infection

2014-10-22 Thread Rejo Zenger
++ 21/10/14 22:29 +0200 - Manuel Gebauer: Although, the greater risk in my opinion, comes from the question if tor operators can be seen as service providers who would be exempt from responsibility for transmitted information under the term of this law. There's no precedence to my

Re: [tor-relays] exit node experience: abuse over HTTP, stealrat infection

2014-10-21 Thread Rejo Zenger
++ 21/10/14 01:58 +0200 - Manuel Gebauer: I learned that the qualification not select or modify acually IS present in German law. § 8 TMG says, that the service provider is not responsible in so far as he did not chose or modify the transmitted information. As the e-Commerce directive is a

Re: [tor-relays] exit node experience: abuse over HTTP, stealrat infection

2014-10-21 Thread Fabian Keil
Manuel Gebauer man...@myops.de wrote: I learned that the qualification not select or modify acually IS present in German law. § 8 TMG says, that the service provider is not responsible in so far as he did not chose or modify the transmitted information. Although, the greater risk in my

Re: [tor-relays] exit node experience: abuse over HTTP, stealrat infection

2014-10-21 Thread Manuel Gebauer
Hi Fabian, Quoting Fabian Keil (2014-10-21 12:55:21) Manuel Gebauer man...@myops.de wrote: Although, the greater risk in my opinion, comes from the question if tor operators can be seen as service providers who would be exempt from responsibility for transmitted information under the

Re: [tor-relays] exit node experience: abuse over HTTP, stealrat infection

2014-10-21 Thread Moritz Bartl
On 10/21/2014 10:29 PM, Manuel Gebauer wrote: Although, the greater risk in my opinion, comes from the question if tor operators can be seen as service providers who would be exempt from responsibility for transmitted information under the term of this law. There's no precedence to my

Re: [tor-relays] exit node experience: abuse over HTTP, stealrat infection

2014-10-20 Thread Rejo Zenger
++ 19/10/14 16:13 +0200 - Manuel Gebauer: ii) in some legal systems this may mean you can be held responsible for the traffic that is routed via your node. Example? In Germany you might (or might not) be responsible for traffic you relay. But not relaying part of the traffic doesn't change a

Re: [tor-relays] exit node experience: abuse over HTTP, stealrat infection

2014-10-20 Thread Manuel Gebauer
Thanks, Rejo (and others) for elucidating the point. I now get your line of thought. I learned that the qualification not select or modify acually IS present in German law. § 8 TMG says, that the service provider is not responsible in so far as he did not chose or modify the transmitted

[tor-relays] exit node experience: abuse over HTTP, stealrat infection

2014-10-19 Thread Kees Goossens
Dear all, I’ve been running tor non-exit relay freshhumbug at torrelay.nl http://torrelay.nl/ for about 3 months now. Recently, I tried running it as an exit relay for a week, with following interesting results. Set up: - Ubuntu 14.04 running as VPS with transip.nl http://transip.nl/, latest

Re: [tor-relays] exit node experience: abuse over HTTP, stealrat infection

2014-10-19 Thread Roger Dingledine
On Sun, Oct 19, 2014 at 01:24:31PM +0200, Kees Goossens wrote: However, the only thing I do with my VPS is run tor. I don???t run a web site, and don???t have apache or whatever installed. I didn???t investigate much further, but my hypothesis is that when publishing the tor-exit notice on

Re: [tor-relays] exit node experience: abuse over HTTP, stealrat infection

2014-10-19 Thread Kees Goossens
Dear Roger, Thanks for quick reply. This possibility did occur to me. When I asked my VPS provider about getting more information for further diagnosis told me they didn’t have more, but that the party that sent them the notification had been reliable in the past. My provider has been

Re: [tor-relays] exit node experience: abuse over HTTP, stealrat infection

2014-10-19 Thread Tom van der Woerdt
Kees Goossens schreef op 19/10/14 13:24: Part 1: Abuse over HTTP. Within one week of being an exit, my provider forwarded the following abuse notification to me ( is the abused Russian website, is me): Greetings, abuse team like to inform you, that we have had mass

Re: [tor-relays] exit node experience: abuse over HTTP, stealrat infection

2014-10-19 Thread Rejo Zenger
++ 19/10/14 13:53 +0200 - Tom van der Woerdt: Sounds familiar. This same company (valuehost.ru?) sends me about 20 abuse reports a day. At first I replied with explanations of what Tor is, explaining why it's hard to do anything against this kind of abuse. Later I [...] IANAL but you can probably

Re: [tor-relays] exit node experience: abuse over HTTP, stealrat infection

2014-10-19 Thread Rejo Zenger
++ 19/10/14 13:48 + - obx: Same here, I've blacklisted their /24 in my torrc. The complaints stopped. That is not a sound approach: i) Tor clients will see unexpected connection errors as some destinations are unreachable where they should and ii) in some legal systems this may mean you can

Re: [tor-relays] exit node experience: abuse over HTTP, stealrat infection

2014-10-19 Thread Drake Wilson
Rejo Zenger wrote: ++ 19/10/14 13:48 + - obx: Same here, I've blacklisted their /24 in my torrc. The complaints stopped. That is not a sound approach: i) Tor clients will see unexpected connection errors as some destinations are unreachable where they should In torrc? Really?

Re: [tor-relays] exit node experience: abuse over HTTP, stealrat infection

2014-10-19 Thread Toralf Förster
On 10/19/2014 03:48 PM, obx wrote: Same here, I've blacklisted their /24 in my torrc. The complaints stopped. Did the same after I got those complaints. B/c my provider do open for every complaint a ticket I do not have another chance than doing this: reject 217.112.0.0/16:* -- Toralf pgp

Re: [tor-relays] exit node experience: abuse over HTTP, stealrat infection

2014-10-19 Thread Manuel Gebauer
Hi, Tom and Rejo. Same with me. Half of the abuse complaints I get are from Valuehost Ru. Because I run on a cheap VPS I don't get a reassigned IP. Therefore I always fear that my provider might lose patience and shut down my server. That's why I decided to block Valuehost's range 217.112.34.0/24

Re: [tor-relays] exit node experience: abuse over HTTP, stealrat infection

2014-10-19 Thread Toralf Förster
On 10/19/2014 01:24 PM, Kees Goossens wrote: Lesson (for me at least): since HTTP was used, even a very reduced exit policy is does not make one immune to abuse problems. At this point I reverted back to being a non-exit relay, as I have no interest in having to deal with this. Well, no

Re: [tor-relays] exit node experience: abuse over HTTP, stealrat infection

2014-10-19 Thread Thomas White
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Yes there are safe harbour provisions. When it comes to civil issues, for example DMCA (Digital Millennium Copyright Act) issues, it is worth considering DMCA title 11 Online Copyright Infringement Liability Limitation Act (OCILLA USA Law) as the

Re: [tor-relays] exit node experience: abuse over HTTP, stealrat infection

2014-10-19 Thread I
Thomas, That sounded so reasonable and persuasive that would it be a good idea to have a formal opinion written to give to server companies early on? They might still be looking at the time it takes to deal with notices or police queries but they must accept that the risks of allowing Tor are

Re: [tor-relays] exit node experience: abuse over HTTP, stealrat infection

2014-10-19 Thread Thomas White
Already working on it (see https://trac.torproject.org/projects/tor/ticket/13421) Will involve a lot of outreach and will need to consider lots of jurisdictions but it can be done with a few volunteers over the next few weeks I feel. I may also be proposing on trac a @torproject.org email for

Re: [tor-relays] exit node experience: abuse over HTTP, stealrat infection

2014-10-19 Thread I
Subject: Re: [tor-relays] exit node experience: abuse over HTTP, stealrat infection Already working on it (see https://trac.torproject.org/projects/tor/ticket/13421) Will involve a lot of outreach and will need to consider lots of jurisdictions but it can be done with a few volunteers

Re: [tor-relays] exit node experience: abuse over HTTP, stealrat infection

2014-10-19 Thread I
that meant Being part of Tor the ideal is available to anyone just by downloading and running it. Robert (you can't imagine how much I envy Roger Dingledine's clarity of expression) ___ tor-relays mailing list tor-relays@lists.torproject.org